id: insecure-cron-jobs

info:
  name: macOS World-Writable Cron Jobs
  author: geeknik
  severity: medium
  description: |
    Finds world-writable cron job files on macOS that can be modified by any user on the system.
  impact: |
    World-writable cron job files can be modified by any user on the system, potentially leading to privilege escalation or execution of malicious code.
  remediation: |
    Review and correct the permissions of world-writable cron job files.
  tags: macos,audit,local,security,cron

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      find /etc/crontab /var/at/tabs/ -perm -o+w -type f -ls 2>/dev/null
    matchers:
      - type: regex
        regex:
          - "\\d+\\s+-[rwx-]*w[rwx-]*w[rwx-]*\\s+"
# digest: 490a00463044022075a77d80b297101e767baa7a3df6a47b36d346be38b58abdd7ea504b7f8b49cb022079d8770c2062a09b57c244e78b22dab6f546cf4d9274013e66ee3dc2baef18b0:922c64590222798bb761d5b6d8e72950